An AI conversation and context-aware based mobile security protection method and system

Abstract

The application discloses a kind of mobile security protection method and system based on AI dialogue and context perception, comprising: receiving the natural language request of user, the structured context object of the context information of device is generated by rule engine;Based on natural language request and context object, parse out user intent and at least one entity to be detected, to generate structured security instruction;Call corresponding threat analysis engine to carry out depth analysis and generate threat analysis result;According to threat analysis result, generate composite response containing natural language explanation and one-key execution operation option, call system interface to execute the protection action corresponding to threat analysis result;Collect the feedback data of user to composite response and continuously optimize parsing and threat analysis capability.The application analyzes device state, network environment and user behavior in real time, and the system can dynamically assess security risks, not only respond to user active query, but also actively push protection suggestions when detecting high-risk environment.

Description

Technical Field

[0001] This invention relates to the fields of information security and artificial intelligence technology, specifically to a mobile security protection method and system based on AI dialogue and context awareness. Background Technology

[0002] Mobile devices are playing an increasingly important role in processing and storing sensitive user data and critical business operations, which places higher technical demands on their security capabilities. Traditional security software relies on menu clicks and button operations, requiring users to have certain security knowledge to use it correctly; when faced with new security risks, users find it difficult to obtain accurate security guidance through simple interactions. Most existing solutions perform isolated detections, failing to combine multi-dimensional contextual information such as real-time device status, network environment, and user behavior for comprehensive risk assessment. Most existing solutions only provide risk alerts without offering direct and convenient handling methods; after receiving warnings, users still need to manually perform complex protective operations, such as finding blocking settings and uninstalling applications, leading to response delays or even operational errors. Summary of the Invention

[0003] The purpose of this invention is to provide a mobile security protection method and system based on AI dialogue and context awareness, so as to solve the problems mentioned in the background art, such as the single interaction method, lack of context awareness, and disconnect between detection and protection.

[0004] To achieve the above objectives, the present invention adopts the following technical solution:

[0005] According to one aspect of the present invention, a mobile security protection method based on AI dialogue and context awareness is provided, the method comprising:

[0006] It receives natural language requests from users, collects device context information in parallel, and generates structured context objects through a rule engine;

[0007] Based on the natural language request and the context object, the user intent and at least one entity to be detected are parsed to generate structured security instructions;

[0008] According to the security instructions, the corresponding threat analysis engine is invoked to perform in-depth analysis on the entity to be detected and generate threat analysis results; the threat analysis results include the risk level, confidence level and evidence for the entity to be detected;

[0009] Based on the threat analysis results, a composite response is generated that includes natural language explanation and one-click execution options. In response to the user's selection of the one-click execution options, the system interface is invoked to execute the protective action corresponding to the threat analysis results.

[0010] Collect user feedback data on the composite response and use the feedback data to continuously optimize parsing and threat analysis capabilities.

[0011] Based on the aforementioned scheme, the structured context object includes: comprehensive risk level, risk factor label set, focus entity set, timestamp, and raw data summary.

[0012] Based on the aforementioned solution, the generation of a structured context object through the rule engine includes:

[0013] The collected context information is encapsulated into a standardized data exchange format object;

[0014] Execute predefined business rules, which are formalized as IF <condition> THEN <action>, where the condition part is a logical judgment of the fields in the data exchange format object, and the action part includes assignment, calculation, adding risk factor labels or triggering new events;

[0015] Assign a weight coefficient to each identified risk factor;

[0016] Calculate the comprehensive risk value based on the risk factor label set and its corresponding weight coefficients;

[0017] The comprehensive risk value is compared with a preset threshold range to generate the comprehensive risk level.

[0018] Based on the aforementioned scheme, the invocation of the corresponding threat analysis engine includes at least one of the following:

[0019] The URL phishing detection engine is invoked to determine the phishing risk level of the target URL by querying the real-time blacklist database, analyzing the static characteristics of the URL, and using an AI classification model.

[0020] The system utilizes an SMS fraud detection engine to identify fraudulent features by verifying the sender's number reputation database and performing natural language semantic analysis on the SMS content.

[0021] The application risk scanning engine is invoked to determine the maliciousness of the application by statically analyzing its permissions and code signatures, and / or by monitoring its running behavior through a dynamic sandbox.

[0022] The device configuration detection engine is invoked to detect unauthorized device status and security patch update status by checking system files and API responses.

[0023] Based on the aforementioned scheme, the generation of threat analysis results also includes:

[0024] Aggregate the risk levels and confidence levels output by various threat analysis engines;

[0025] Based on a predefined risk aggregation strategy, the risk levels and confidence levels output by multiple threat analysis engines are comprehensively calculated to generate the final overall risk level.

[0026] By integrating analytical evidence from various threat analysis engines, a multi-dimensional supporting explanation for the overall risk level is formed.

[0027] Based on the aforementioned scheme, generating the composite response includes generating the natural language interpretation based on the threat analysis results through template matching or a large language model; mapping the executable action suggestions in the threat analysis results to system API call instructions, and generating corresponding graphical operation elements in the user interface as the one-click execution operation options.

[0028] Based on the aforementioned scheme, the continuous optimization using the feedback data includes:

[0029] Collect feedback data from the user's composite response;

[0030] The feedback data is associated with the corresponding historical interaction sessions to form standardized training samples;

[0031] Use at least one of the following optimization paths:

[0032] For the machine learning model, an incremental learning algorithm is used to continuously fine-tune the intent recognition, entity extraction, and threat detection models using the feedback data;

[0033] For large language models, the Prompt construction strategy is dynamically adjusted based on the feedback data.

[0034] Based on the aforementioned scheme, the feedback data includes explicit feedback data and implicit feedback data; explicit feedback data consists of the user's false alarm markers, confirmed alarm markers, and satisfaction ratings for the system's suggestions; implicit feedback data consists of the user's acceptance or rejection of the one-click execution operation option, as well as the reverse operation record of the executed protection action.

[0035] According to another aspect of the present invention, a mobile security protection system based on AI dialogue and context awareness is provided. The system includes a user interaction interface module, a context awareness module, a semantic understanding module, a threat analysis module, a response generation and execution module, and a self-learning module.

[0036] The user interaction interface module is used to receive natural language requests input by the user and present a composite response that includes a natural language explanation and at least one one-click operation option.

[0037] The context awareness module is communicatively connected to the user interaction interface module; it is used to acquire the device's context information; and to process the context information based on predefined rules to generate a structured context object, wherein the context object contains at least a comprehensive risk level and a risk factor tag set.

[0038] The semantic understanding module is communicatively connected to the user interaction interface module and the context awareness module; based on the natural language request and the structured context object, it parses out the user intent and at least one entity to be detected; and generates structured security instructions.

[0039] The threat analysis module is communicatively connected to the semantic understanding module; it is used to invoke at least one threat analysis engine to analyze the entity to be detected according to the security instructions; and to aggregate the analysis results of each threat analysis engine to generate a structured threat analysis result.

[0040] The response generation and execution module is communicatively connected to the user interaction interface module and the threat analysis module; it is used to generate the composite response based on the threat analysis results; and to execute the corresponding protection action in response to the user's selection of the one-click execution operation option.

[0041] The self-learning module is communicatively connected to the user interaction interface module, the semantic understanding module, and the threat analysis module; it is used to collect user feedback data on the composite response; and to optimize the performance of the semantic understanding module and / or the threat analysis module using the feedback data.

[0042] Based on the aforementioned solution, the context-aware module processes the context information through a rule engine, wherein the rule engine includes:

[0043] The collected context information is encapsulated into a standardized data exchange format object; the rules are formally defined as IF <condition> THEN <action>, where the condition part is a logical judgment of the fields in the data exchange format object, and the action part includes, but is not limited to, assignment, calculation, adding risk factor labels or triggering new events; a weight coefficient is assigned to each identified risk factor; a comprehensive risk value is calculated based on the risk factor label set and its corresponding weight coefficient; the comprehensive risk value is compared with a preset threshold range to generate the comprehensive risk level.

[0044] As can be seen from the above technical solution, the present invention has at least the following advantages and positive effects compared with the prior art: By supporting natural language dialogue interaction, users can express their security needs in everyday language without having to learn professional security terminology or complex operating procedures; by analyzing device status, network environment and user behavior in real time through the context-aware module, the system can dynamically assess security risks, not only responding to user-initiated queries, but also proactively pushing protection suggestions when high-risk environments are detected; by converting professional threat detection results into easy-to-understand natural language explanations, users can clearly understand the reasons for the risks, while providing "one-click execution" protection operations, such as one-click blocking of websites, one-click activation of VPNs, etc., which significantly shortens the path from risk discovery to security handling; by establishing a feedback-driven self-learning closed loop, the semantic understanding model and threat detection algorithm can be continuously optimized from user acceptance / rejection, false alarms / confirmed alarms, etc., enabling the system to effectively cope with constantly evolving network attack methods.

[0045] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit the invention. Attached Figure Description

[0046] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention. It is obvious that the drawings described below are merely some embodiments of the invention, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort. In the drawings:

[0047] Figure 1 This is a schematic diagram of a mobile security protection method based on AI dialogue and context awareness according to the present invention;

[0048] Figure 2 A schematic diagram illustrating the generation of structured security instructions for this invention;

[0049] Figure 3 This is a schematic diagram illustrating the threat analysis results generated by the present invention.

[0050] Figure 4 This is a schematic diagram of a mobile security protection system based on AI dialogue and context awareness according to the present invention. Detailed Implementation

[0051] To more clearly illustrate the purpose, technical solutions, and advantages of the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein. On the contrary, these embodiments are provided so that the present invention will be more comprehensive and complete, and fully convey the concept of the exemplary embodiments to those skilled in the art.

[0052] Furthermore, the described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. Numerous specific details are provided in the following description to give a full understanding of embodiments of the invention. However, those skilled in the art will recognize that the technical solutions of the invention can be practiced without one or more of the specific details, or other methods, components, apparatuses, steps, etc., can be employed. In other instances, well-known methods, apparatuses, implementations, or operations are not shown or described in detail to avoid obscuring various aspects of the invention.

[0053] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities can be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0054] The flowcharts shown in the accompanying drawings are merely illustrative and do not necessarily include all content and operations / steps, nor do they necessarily have to be performed in the described order. For example, some operations / steps can be broken down, while others can be combined or partially combined; therefore, the actual execution order may change depending on the specific circumstances.

[0055] The present invention will now be described in detail with reference to specific embodiments:

[0056] Example 1, such as Figure 1 As shown in the figure, this embodiment provides a mobile security protection method based on AI dialogue and context awareness. The specific steps of the method are as follows:

[0057] S1: Receives natural language requests from users, collects device context information in parallel, and generates structured context objects through the rule engine.

[0058] The system receives natural language requests from users, collects device status, network environment, and communication metadata in parallel as context information, and processes the context information through a rule engine to generate a structured context object containing a comprehensive risk level.

[0059] Specifically, the system receives security inquiries or operation requests input by the user in natural language through a user interface deployed on the user's device. The user interface includes text input boxes in a graphical user interface or a voice input interface with integrated speech recognition functionality. Natural language requests are unstructured text data freely input by the user. For example, the user might input: "Is this website safe?".

[0060] In response to a user request, the system collects real-time operational status information of the user device in parallel by calling the application programming interface provided by the operating system. The context information includes at least device status information, network environment information, and communication metadata. Among them, the device status information includes the operating system version, security patch level, application permission list, and running process list; the network environment information includes the currently connected network type, service set identifier, and virtual private network activation status; and the communication metadata, with the user's authorization, obtains the SMS service sender, email sender and title, and the currently accessed Uniform Resource Locator.

[0061] Furthermore, the collected context information from heterogeneous devices from multiple sources is processed by a rule engine to output a machine-readable structured context object. This processing includes: encapsulating context information from different sources into a standardized data exchange format object; performing logical reasoning on the normalized data based on predefined business rules and weighting strategies to calculate the comprehensive risk level and generate a corresponding risk factor tag set; and the rule engine outputting a context object containing a preliminary risk assessment based on basic context information such as device status and network environment.

[0062] Specifically, multi-source heterogeneous device context information refers to a collection of raw data collected from different hardware modules, software systems, and communication protocols of a user device, which differ in data format, structure, and semantics. Its data sources include device system sources (such as operating system kernels, system settings, and device status interfaces), network communication sources (network protocol stacks, Wi-Fi managers, and mobile network modems), and user application sources (SMS databases, browser history, and application permission managers). Its data form may exhibit heterogeneity in format, semantics, and acquisition method. Format heterogeneity includes system version number (string type), security patch date (date type), VPN status (boolean type), running process list (list type), and network signal strength (integer type). Semantic heterogeneity arises because data with the same meaning from different sources may be expressed in different forms; for example, VPN status in Android may be determined through a NetworkCapabilities object, while in iOS it is represented by the NEVPNStatus enumeration value. Acquisition method heterogeneity occurs when some data is obtained through synchronous API calls (such as device model), some data is obtained asynchronously by listening to system broadcasts (such as network switching events), and some data requires specific permissions to access (such as SMS metadata).

[0063] The collected context information from multi-source heterogeneous devices is cleaned, removing redundant fields irrelevant to security risk assessment, and sensitive information (such as device unique identifiers) is de-identified using salted hashing. The cleaned data is then encapsulated into a standardized data exchange format object, which serves as a unified data container. A preferred embodiment is a JSON (JavaScript Object Notation) object or a Protocol Buffers serialized data structure. Furthermore, the rule engine relies on a predefined, updatable rule base. Each rule is a "condition-action" pair, formally defined as IF <condition> THEN <action>. The condition is a logical judgment of a field in the standardized data exchange format object, and the action includes, but is not limited to, assignment, calculation, adding tags, or triggering a new event. For example, rule R1 might be defined in the rule base as:

[0064] IF (network.wifi_ssid IN public_wifi_list AND network.vpn_established== false) THEN RISK_FACTOR = "public_wifi_no_vpn". The rule engine takes the output standardized data object as "fact" input and matches it against the condition parts of all rules in the rule base; rules that meet all conditions are activated and added to the execution agenda; the rule engine executes the action parts of these rules, thereby generating an initial risk factor label set (e.g., ["public_wifi_no_vpn", "outdated_patch"]); it queries the predefined risk factor weight mapping table to obtain the weight coefficient corresponding to each risk factor, forming a weight set (e.g., [0.9, 0.7]).

[0065] To achieve accurate quantitative assessment, the system predefines weight coefficients for different risk factors, which characterize the degree of influence of each factor on the overall risk. When comprehensively calculating the weights of these risk factors, a weighted summation method can be used: based on a predefined risk level numerical mapping table, each risk factor is mapped to a numerical base value, then the comprehensive risk value is calculated as Σ(numerical base value × weight coefficient). The calculation result is then compared with a preset threshold range to map to a discrete comprehensive risk level (e.g., "low", "medium", "high"). Alternatively, the maximum value method can be used, taking the risk factor level with the highest weight as the comprehensive level. After reasoning and calculation by the rule engine, a semantically rich, machine-readable structured context object is finally output. This structured context object includes: comprehensive risk level, risk factor tag set, focus entity set, timestamp, and original data summary.

[0066] The comprehensive risk level characterizes the overall security level of the environment in which the device is currently located. The data is in the form of discrete enumeration values, preferably implemented as LOW, MEDIUM, HIGH, or CRITICAL. It is obtained by mapping multiple risk factors through weighted aggregation calculations using a rule engine. It should be noted that the comprehensive risk level connects context awareness and personalized response, driving AI to generate personalized and graded security interpretations. The comprehensive risk level runs through the subsequent dialogue generation, user interaction, and system optimization processes: on the one hand, it drives the adjustment of the tone and content detail of the natural language interpretation during dialogue generation; on the other hand, it guides the generation of protective operation suggestions that match the risk level during operation execution, and also serves as the basis for differentiated prompt rendering in the user interface.

[0067] The risk factor set records the specific reasons leading to the current risk level, forming the interpretability basis for decision-making, and includes a list of at least one risk factor description object. The focus entity set indicates the security detection targets that require special attention in the current context, and includes a list of at least one entity description object. The timestamp records the generation time of this context snapshot, used for time-series analysis and context validity verification. The raw data digest retains a hash or anonymized digest of key raw data for auditing and traceability. This structured context object explicitly answers three key questions: "How high is the current environmental risk?" (overall_risk_level), "Why is the risk high?" (risk_factors), and "What should be the focus?" (focus_entities), providing decisive input for subsequent AI dialogue understanding to generate accurate and personalized security recommendations.

[0068] S2: Based on the natural language request and the context object, parse the user intent and at least one entity to be detected to generate structured security instructions.

[0069] Semantic parsing and instruction generation of user natural language requests hinges on fusing unstructured user queries with structured contextual information to generate standardized, secure, machine-executable instructions. To achieve accurate and efficient parsing of user natural language requests, while also considering the varying requirements for computing resources, response speed, data privacy, and cost across different application scenarios, such as… Figure 2 As shown, this embodiment provides two parsing methods:

[0070] In one implementation, Natural Language Processing (NLP) is employed, specifically including: preprocessing the input text, which involves identifying and anonymizing potential privacy information (such as phone numbers and ID numbers) in the user query; segmenting the user request into independent tokens, removing meaningless stop words, retaining core words, and then converting the text into numerical vectors such as TF-IDF or word embedding models for use by the classifier. Further, intent recognition is performed by inputting the preprocessed text vectors into a pre-trained text classification model, such as one built on BERT, SVM, or FastText, which is continuously optimized, and outputting predefined intent labels, such as url_check (website security check), sms_analysis (SMS analysis), device_scan (device scan), and general_help (general help). Sequence labeling models such as BiLSTM-CRF or BERT-CRF are used to identify the specific objects and their types to be detected from user requests. The model classifies each word in the input sequence and outputs the identified entities and their types. The identified user intent is integrated with the entities and contextual information. A set of decision rules combines the key entities and risk factors in the context with the parsing results to assemble a structured security instruction object. For example, the decision rules can be:

[0071] IF Intent is url_check AND Extracted entity contains URL THEN Detection target = that URL.

[0072] If the intent is general_scan AND the overall risk level is HIGH, then the target for detection is ["network","running_apps"] (i.e., perform a network and application-specific scan).

[0073] In another implementation, a Large Language Model (LLM) is used for end-to-end parsing tasks. This includes: constructing structured prompts, defining roles, tasks, and output formats, and including context fields and user query fields. For example, the prompts might include: "You are a mobile security assistant. Please analyze the user's security needs based on their query and the current device context."; "Output requirements: Please strictly output a JSON object containing the following fields: "intent": User intent, optional values ​​[url_check, sms_analysis, app_scan, device_scan, network_check]; "target_entities": A list containing all specific objects to be detected, such as URLs, phone numbers, etc.; "suggested_actions": A list suggesting detection actions the system should perform, such as ["scan_url", "check_network_risk"]". The LLM service is called via API, and its text response is received. A JSON parser is used to parse the response string into an in-memory data structure object. Field validity is validated on the JSON object output by the LLM, and the fields output by the LLM are mapped to standard instruction fields defined internally by the system. Optionally, if the JSON object output by the large language model is incorrectly formatted or has missing fields, an alternative parsing strategy will be enabled, including: using predefined rules for intent matching, or triggering a clarification dialogue to require the user to re-enter the information.

[0074] Finally, a standardized structured security instruction object is generated. This object is a machine-readable data structure that contains at least the following fields: user intent identifier, target_entities list to be detected, suggested_actions list of detection actions, and related context_metadata.

[0075] S3: According to the security instruction, call the corresponding threat analysis engine to perform in-depth analysis on the entity to be detected and generate threat analysis results; the threat analysis results include the risk level, confidence level and evidence for the entity to be detected.

[0076] In this embodiment, structured security instructions are parsed and detected and routed. Multiple threat analysis engines are called in parallel to perform detection and output threat analysis results. The preliminary detection results returned by each threat detection and analysis engine are aggregated, and an overall risk level is generated based on a predefined risk aggregation strategy. Based on the overall risk level and the entity to be detected, an executable action suggestion containing at least one system-level operation instruction is generated. The structured threat analysis result is constructed based on the overall risk level, analysis evidence, and executable action suggestion.

[0077] like Figure 3 As shown, based on the received structured security instructions, the operation intent field and target entity field are parsed; based on the parsing results, the detection task is dynamically routed to at least one corresponding threat analysis engine through the task scheduler; wherein, the threat analysis engine includes multiple of the following: URL phishing detection engine, SMS fraud detection engine, application risk scanning engine, and device configuration detection engine.

[0078] Specifically, the `action` and `target_entities` fields in the security directive are parsed, and corresponding detection tasks are created based on the parsing results. These tasks are then distributed to one or more threat analysis engines. For example, the directive `{"action": "scan_url", "target_entities": ["http: / / evil.com"]}` will be routed to the URL phishing detection engine. The invoked threat analysis engine performs specialized detection on the entity to be detected. The task scheduler uses a thread pool or asynchronous task mechanism to implement parallel calls to each threat analysis engine and sets a uniform timeout. If a threat analysis engine does not return a result within the timeout period, it continues to perform aggregation calculations based on the returned results to ensure service response performance. The implementation methods of each threat analysis engine include:

[0079] The URL phishing detection engine comprehensively assesses the phishing risk level of a target URL by querying a real-time blacklist database, analyzing static URL features, and using a trained AI classification model. Specifically, it includes: calling the API of an external security intelligence database (such as Google Safe Browsing) to query whether the URL exists in a known list of malicious websites for real-time blacklist lookup; analyzing the URL string itself to detect suspicious features (such as long domain names, numerous special characters, and spelling errors mimicking well-known domain names) for static feature analysis; and using local or cloud-based machine learning models to dynamically determine whether it is a phishing website based on URL features, WHOIS information, and website content (such as login forms) for AI model classification.

[0080] This SMS fraud detection engine identifies fraudulent features and social engineering attack patterns by verifying the sender's number reputation database and performing natural language semantic analysis on the SMS content. Specifically, it includes: querying local or cloud-based blacklists to check if the sender's number is a known fraudulent or marketing account; and using NLP techniques (such as text classification models or LLM) to analyze SMS content, identifying fraudulent phrases (such as "won a prize," "account abnormality," "request for verification code"), urgency, and malicious links for semantic analysis.

[0081] The application risk scanning engine determines application malice by statically analyzing application permissions and code signing, and / or by monitoring its runtime behavior through a dynamic sandbox. Specifically, this includes: checking the APK / IPA file's permission requests (whether excessive requests are made), certificate signing (whether it is official), and code structure (whether it has been repackaged); running the application in a sandbox environment to monitor its network behavior (whether it connects to malicious C&C servers), file operations (whether it steals privacy), and system calls; and matching the application version with publicly available vulnerability databases (such as CVEs).

[0082] The device configuration detection engine checks system files and API responses to detect unauthorized access and security patch update status. Specifically, this includes: determining if a device has been compromised by checking specific files, API responses, or system properties; and comparing the device's current security patch level with the latest officially released patch level.

[0083] Each threat analysis engine outputs its analysis results, which include at least: the initial risk level, confidence level, and evidence for the determination of the target entity.

[0084] Furthermore, the preliminary detection results returned by various threat analysis engines are aggregated; based on a predefined risk aggregation strategy, the initial risk levels and confidence levels output by multiple threat analysis engines are comprehensively calculated to generate the final overall risk level; and the analytical evidence from various threat analysis engines is integrated to form a multi-dimensional supporting explanation for the overall risk level.

[0085] Specifically, the predefined risk aggregation strategies include, but are not limited to: the highest risk priority principle, the confidence-weighted decision principle, and the veto principle. The highest risk priority principle stipulates that when the outputs of multiple threat analysis engines are inconsistent, the result with the highest risk level among all outputs is adopted as the overall risk level. Specifically, it iterates through the risk levels output by all threat analysis engines, maps them to an internally defined numerical scale (e.g., low=1, medium=2, high=3, severe=4), then takes the maximum value, and maps that value back to the corresponding risk level label. The confidence-weighted decision principle assigns a base value (RV) to each primary risk level. The base value output by each threat analysis engine is multiplied by its confidence level to obtain a weighted risk value. All weighted risk values ​​are aggregated (e.g., summed, averaged) to obtain the overall risk value. This overall risk value is then compared with a preset threshold range to obtain the overall risk level. The veto principle stipulates that for a specific, pre-defined severe risk (e.g., IF any engine.output.risk == “MALWARE” AND confidence level > 0.95), if any threat analysis engine detects such a risk, regardless of the results of other threat analysis engines, the overall risk level will be immediately determined to be the highest level.

[0086] The risk level and confidence level output from multiple threat analysis engines are comprehensively calculated. Taking the confidence-weighted decision principle as an example, the input contains a list of output tuples (risk level, confidence level, evidence) for each called threat analysis engine. The text-based risk level is mapped to a numerical value according to the risk level mapping table. For each engine output, its weighted contribution value is calculated using the formula: Contribution value = Risk level value × Confidence level. Weighted summation or weighted average can be used to calculate all contribution values. The calculated overall risk value is compared with a preset threshold range to determine the final overall risk level. For example, [0, 1.5) is a LOW risk level, [1.5, 2.5) is a MEDIUM risk level, [2.5, 3.5) is a HIGH risk level, and [3.5, ∞) is a CRITICAL risk level.

[0087] After completing the detection, the threat analysis engine outputs structured results containing analytical evidence. The generation of this evidence follows standardized principles, transforming raw detection data into machine-readable and user-understandable evidence descriptions. Each engine has its unique detection methods and evidence generation logic. Taking a URL phishing detection engine as an example, evidence is generated based on blacklist matching, including querying matching results from external security intelligence databases; evidence is generated based on static feature analysis, including identifying spoofed domain characteristics and abnormal character patterns in URLs; and evidence is generated based on AI model inference, including the model's classification confidence level for website content and the contribution of key features.

[0088] The system integrates analytical evidence from various threat analysis engines, formatting, sorting, and deduplicating it to form a multi-dimensional support explanation for the overall risk level. Evidence fields, which are text or structured data describing the rationale behind the judgment, are extracted from the output of each invoked threat analysis engine. The raw evidence from different threat analysis engines is formatted into a unified descriptive structure. The evidence list is sorted from highest to lowest risk level according to the corresponding threat analysis engine's output, highlighting key points; or the evidence list is sorted from highest to lowest confidence level, prioritizing the most certain judgment criteria. Similar evidence from different threat analysis engines is merged to avoid redundancy.

[0089] Based on the overall risk level and target entity type, a predefined action mapping table is queried. This table is constructed using expert knowledge and historical experience in the security field, and its mapping relationships can be dynamically adjusted by the system administrator or through a self-learning module. It defines the system-level protection operations corresponding to different combinations of risk types and entity types. Based on the query results, a set of protection suggestions is generated, containing at least one executable operation instruction. This instruction includes at least one of the following: blocking network resources, intercepting communication numbers, uninstalling applications, repairing device configuration, and enabling security services.

[0090] The overall risk level, analytical evidence, and actionable recommendations are encapsulated in a machine-readable structured threat analysis result object. The structured threat analysis result object contains at least the following fields: overall risk level field; target entity description field; detection details list field, including the initial risk level, confidence level, and evidence of each threat analysis engine; and actionable recommendations field, including natural language explanations and corresponding system API call instructions.

[0091] S4: Based on the threat analysis results, generate a composite response that includes natural language explanation and one-click execution options. In response to the user's selection of the one-click execution options, call the system interface to execute the protection action corresponding to the threat analysis results.

[0092] Based on the threat analysis results, a composite response is generated, including a natural language explanation and at least one one-click action option. The one-click action option corresponds to the system-level operation instructions in the suggested executable actions. One-click actions can include blocking network resources, intercepting communication numbers, uninstalling applications, etc. In response to the user's selection of a one-click action option, the underlying system API is invoked to execute the corresponding protective action, and the execution result is fed back to the user. The generation of the natural language explanation includes selecting a matching text template and filling in variables based on a predefined explanation template library, according to the overall risk level, target entity type, and risk evidence in the threat analysis results; or calling a large language model service, using the threat analysis results as input, and having the large language model generate a natural language security description that meets the user's comprehension level. The choice between template filling or large language model generation of the natural language explanation is dynamically selected based on user settings, network availability, and processing performance requirements. Simultaneously, based on the suggested executable actions in the threat analysis results, corresponding graphical operation elements are generated in the user interface; after the user selects and executes an action, the corresponding graphical operation element is disabled or removed from the interface.

[0093] Each graphical operation element is bound to a corresponding system call instruction; wherein, the system call instruction is mapped to the operation identifier defined in the threat analysis results; the mapping relationship includes: blocking network resources operation is mapped to the blocking application interface of the network management component; blocking communication numbers operation is mapped to the blacklist management interface of the communication management group; uninstalling application operation is mapped to the uninstall application interface of the package management group; and enabling security service operation is mapped to the service startup interface of the system service management group.

[0094] In response to user selection of graphical operation elements, the system triggers corresponding system call instructions. It then executes the protective action corresponding to the operation identifier by calling the secure execution interface provided by the operating system. The execution process includes parameter passing, permission verification, and invocation of underlying system services. Permission verification includes checking whether the application has the necessary system permissions to execute the protective action; if permissions are insufficient, execution is terminated and a failure error is triggered. After executing the protective action, the system captures the execution status information returned by the system. Based on the execution status information, the system generates and displays the corresponding operation result prompt in the user interface. If the execution status information indicates failure, an error log is automatically recorded, and an alternative execution plan is attempted, or the user is guided to make manual settings. The operation result prompt includes at least one of a success confirmation message or a failure error message.

[0095] S5: Collect user feedback data on the composite response and use the feedback data to continuously optimize the parsing and threat analysis capabilities.

[0096] Through the user interface, multimodal feedback data on user responses to composite responses is continuously collected. This feedback data includes explicit and implicit feedback data. Explicit feedback data consists of user false positive and confirmed positive flags, as well as satisfaction ratings for system suggestions. False positive flags indicate that the user believes the system's judgment is incorrect, while confirmed positive flags indicate that the user believes the system's judgment is correct. Implicit feedback data includes user acceptance or rejection of one-click action options, as well as records of reverse actions performed (e.g., the user manually unblocking a blocked website). For example, clicking buttons such as "One-Click Block" or "One-Click Repair" indicates acceptance, while clicking "Ignore," "Cancel," or directly closing the prompt indicates rejection.

[0097] Using a unique session identifier, the collected feedback data is associated and matched with corresponding historical interaction sessions to form standardized training samples. Historical interaction sessions include at least: the user's original query, structured context objects, threat analysis results, and system actions. The associated data is then cleaned and labeled. The correct intent labels of false positive samples are labeled as negative, and entity labels are removed. The intent and entity labels of confirmed positive samples are identified as positive samples. User acceptance / rejection behaviors are quantified as positive / negative reward signals for reinforcement learning, used to adjust the update direction of model parameters during policy optimization.

[0098] Preferably, based on the type of feedback data and the technical approach used (the method of parsing the user's natural language request), model optimization is divided into the following two aspects:

[0099] For machine learning models: Incremental learning algorithms or periodic fine-tuning strategies are employed to continuously optimize the following models using training samples: Intent recognition models: False positive samples are used to adjust the classification decision boundary to reduce the intent confidence of false positive queries. For example, when a user marks the judgment of "Is this website safe?" as a false positive, the weight of similar queries classified as url_check intent is reduced; Entity extraction models: The model is trained with correctly labeled data to enhance the ability to generalize and recognize entities with diverse expressions; Threat detection models: False positive / confirmed positive features are added to the negative / positive sample sets respectively to update the detection model parameters.

[0100] For the optimization of interaction strategies in large language models: Based on feedback analysis, implement at least one of the following Prompt optimization strategies: dynamically update the example library, incorporating the triples of successful interactions (user query, context, correct output) as new few-shot examples into subsequent Prompt construction; extract error patterns, analyze false positives and rejection operations, summarize LLM misjudgment patterns, and add targeted constraints to system instructions; iterate system instructions, continuously revising and optimizing the instruction descriptions of structured output based on extensive feedback analysis, making their role positioning more accurate and their output format more stable.

[0101] Versioning optimized models and strategies allows for the initial deployment of new models in a small user base (A / B testing) to verify their improved performance before full release, ensuring smooth and stable system updates.

[0102] This embodiment achieves continuous evolution of system performance by capturing user interaction feedback to build a training data closed loop, thereby dynamically optimizing the accuracy of semantic understanding and threat detection.

[0103] Example 2, as Figure 4 As shown in the figure, this embodiment exemplarily presents a mobile security protection system based on AI dialogue and context awareness, including a user interaction interface module, a context awareness module, a semantic understanding module, a threat analysis module, a response generation and execution module, and a self-learning module;

[0104] The user interaction interface module is used to receive natural language requests input by the user and present a composite response that includes a natural language explanation and at least one one-click operation option.

[0105] The context-aware module communicates with the user interaction interface module; it is used to obtain the device's context information; it processes the context information based on predefined rules to generate a structured context object, which at least contains a comprehensive risk level and a risk factor tag set;

[0106] The semantic understanding module communicates with the user interaction interface module and the context awareness module; based on natural language requests and structured context objects, it parses out the user intent and at least one entity to be detected; and generates structured security instructions.

[0107] The threat analysis module communicates with the semantic understanding module; it is used to invoke at least one threat analysis engine to analyze the entity to be detected according to security instructions; and it aggregates the analysis results of each threat analysis engine to generate structured threat analysis results.

[0108] The response generation and execution module communicates with the user interaction interface module and the threat analysis module; it is used to generate a composite response based on the threat analysis results; and in response to the user's selection of the one-click execution operation option, it executes the corresponding protection action.

[0109] The self-learning module communicates with the user interaction interface module, semantic understanding module, and threat analysis module; it is used to collect user feedback data on composite responses; and it uses the feedback data to optimize the performance of the semantic understanding module and / or threat analysis module.

[0110] The context-aware module processes contextual information through a rule engine, which includes:

[0111] The collected context information is encapsulated into a standardized data exchange format object; the rules are formally defined as IF <condition> THEN <action>, where the condition part is a logical judgment of the fields in the data exchange format object, and the action part includes, but is not limited to, assignment, calculation, adding risk factor labels or triggering new events; each identified risk factor is assigned a weight coefficient; based on the risk factor label set and its corresponding weight coefficient, the comprehensive risk value is calculated; the comprehensive risk value is compared with a preset threshold range to generate a comprehensive risk level.

[0112] Other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of the invention are indicated by the claims. It should be understood that the invention is not limited to the precise structures described above and shown in the drawings, and various modifications and changes can be made without departing from its scope. The scope of the invention is limited only by the appended claims.

Claims

1. A mobile security protection method based on AI dialogue and context awareness, characterized in that, The method includes: The system receives natural language requests from users, collects device context information in parallel, and generates structured context objects through a rule engine. The natural language requests are security consultations or operation requests actively input by the user. The context information includes device status information, network environment information, and communication metadata. The structured context objects include a comprehensive risk level and a set of risk factor tags calculated based on the context information. Based on the natural language request and the context object, the user intent and at least one entity to be detected are parsed to generate structured security instructions; According to the security instructions, the corresponding threat analysis engine is invoked to perform in-depth analysis on the entity to be detected and generate threat analysis results; the threat analysis results include the risk level, confidence level and evidence for the entity to be detected; Based on the threat analysis results, a composite response is generated that includes natural language explanation and one-click execution options. In response to the user's selection of the one-click execution options, the system interface is invoked to execute the protective action corresponding to the threat analysis results. The protective action includes blocking network resources, intercepting communication numbers, and uninstalling applications. Collect user feedback data on the composite response and use the feedback data to continuously optimize parsing and threat analysis capabilities.

2. The mobile security protection method based on AI dialogue and context awareness according to claim 1, characterized in that, The structured context objects include: comprehensive risk level, risk factor label set, focus entity set, timestamp, and raw data summary.

3. The mobile security protection method based on AI dialogue and context awareness according to claim 2, characterized in that, The generation of structured context objects through the rule engine includes: The collected context information is encapsulated into a standardized data exchange format object; Execute predefined rules, which are formalized as IF <condition> THEN <action>, where the condition part is a logical judgment of the fields in the data exchange format object, and the action part includes assignment, calculation, adding risk factor labels or triggering new events; Assign a weight coefficient to each identified risk factor; Calculate the comprehensive risk value based on the risk factor label set and its corresponding weight coefficients; The comprehensive risk value is compared with a preset threshold range to generate the comprehensive risk level.

4. The mobile security protection method based on AI dialogue and context awareness according to claim 1, characterized in that, The invocation of the corresponding threat analysis engine includes at least one of the following: The URL phishing detection engine is invoked to determine the phishing risk level of the target URL by querying the real-time blacklist database, analyzing the static characteristics of the URL, and using an AI classification model. The system utilizes an SMS fraud detection engine to identify fraudulent features by verifying the sender's number reputation database and performing natural language semantic analysis on the SMS content. The application risk scanning engine is invoked to determine the maliciousness of the application by statically analyzing its permissions and code signatures, and / or by monitoring its running behavior through a dynamic sandbox. The device configuration detection engine is invoked to detect unauthorized device status and security patch update status by checking system files and API responses.

5. A mobile security protection method based on AI dialogue and context awareness according to claim 1, characterized in that, The generated threat analysis results also include: Aggregate the risk levels and confidence levels output by various threat analysis engines; Based on a predefined risk aggregation strategy, the risk levels and confidence levels output by multiple threat analysis engines are comprehensively calculated to generate the final overall risk level. By integrating analytical evidence from various threat analysis engines, a multi-dimensional supporting explanation for the overall risk level is formed.

6. A mobile security protection method based on AI dialogue and context awareness according to claim 1, characterized in that, Generating the composite response includes generating a natural language interpretation based on the threat analysis results through template matching or a large language model; mapping the executable action suggestions in the threat analysis results to system API call instructions, and generating corresponding graphical operation elements in the user interface as the one-click execution operation options.

7. A mobile security protection method based on AI dialogue and context awareness according to claim 1, characterized in that, The continuous optimization using the feedback data includes: The feedback data is associated with the corresponding historical interaction sessions to form standardized training samples; Use at least one of the following optimization paths: For the machine learning model, an incremental learning algorithm is used to continuously fine-tune the intent recognition, entity extraction, and threat detection models using the feedback data; For large language models, the Prompt construction strategy is dynamically adjusted based on the feedback data.

8. A mobile security protection method based on AI dialogue and context awareness according to claim 7, characterized in that, The feedback data includes explicit feedback data and implicit feedback data; explicit feedback data includes the user's false alarm markers, confirmed alarm markers, and satisfaction ratings for the system's suggestions; implicit feedback data includes the user's acceptance or rejection of the one-click execution operation option, as well as the reverse operation record of the executed protection action.

9. A mobile security protection system based on AI dialogue and context awareness, characterized in that, It includes a user interaction interface module, a context-aware module, a semantic understanding module, a threat analysis module, a response generation and execution module, and a self-learning module; The user interaction interface module is used to receive natural language requests input by the user and present a composite response that includes a natural language explanation and at least one one-click operation option. The context-aware module is communicatively connected to the user interaction interface module. Used to obtain the device's context information; the context information is processed based on predefined rules to generate a structured context object, which contains a comprehensive risk level and a set of risk factor labels; The semantic understanding module is communicatively connected to the user interaction interface module and the context awareness module. Based on the natural language request and the structured context object, the user intent and at least one entity to be detected are parsed. Generate structured security instructions; The threat analysis module is communicatively connected to the semantic understanding module. Used to invoke at least one threat analysis engine to analyze the entity to be detected according to the security instructions; aggregate the analysis results of each threat analysis engine to generate a structured threat analysis result; The response generation and execution module is communicatively connected to the user interaction interface module and the threat analysis module. Used to generate the composite response based on the threat analysis results; In response to the user's selection of the one-click operation option, the corresponding protective action is executed; The self-learning module is communicatively connected to the user interaction interface module, the semantic understanding module, and the threat analysis module; it is used to collect user feedback data on the composite response; and to optimize the performance of the semantic understanding module and / or the threat analysis module using the feedback data.

10. A mobile security protection system based on AI dialogue and context awareness according to claim 9, characterized in that, The context-aware module processes the context information through a rule engine, which includes: The collected context information is encapsulated into a standardized data exchange format object; the rules are formally defined as IF <condition> THEN <action>, where the condition part is a logical judgment of the fields in the data exchange format object, and the action part includes assignment, calculation, adding risk factor labels or triggering new events; a weight coefficient is assigned to each identified risk factor; based on the risk factor label set and its corresponding weight coefficient, a comprehensive risk value is calculated; the comprehensive risk value is compared with a preset threshold range to generate the comprehensive risk level.

Images